# CVE-2026-30863: parse-server — Fix Available 📦 npm Not in CISA KEV # CVE-2026-30863 — parse-server CVE-2026-30863 is a Improper Authentication vulnerability in parse-server. A fix is available for parse-server — see the affected versions and patch details below. Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters Also known asBIT-parse-2026-30863[GHSA-x6fw-778m-wr9v](/vulnerability/GHSA-x6fw-778m-wr9v) Published Mar 7, 2026 Updated Oct 28, 2026 Affected 2 pkgs Patched 2 / 2 Exploits None indexed Exploitation data as of Nov 5, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### No confirmed exploitation observed yet - CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks. - A successful exploit gives an attacker total control of the affected component, not partial access. - CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment. Exploitation and automatability from CISA’s SSVC triage for CVE-2026-30863. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.6%probability of exploitation in next 30 days Lower Risk+0.04% Lower risk than most CVEs48th percentile — riskier than 48% of all scored CVEsHighest risk 0.00%0.40%0.79%1.19%0.0%0.6%May 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## Real-World Exposure 2 pkgs affected How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched. 62other npm packages depend on this — each one inherits the vulnerability until it's patched upstream `parse-server`npm 70Kdownloads / week ## Description #### Impact The Google, Apple, and Facebook authentication adapters use JWT verification to validate identity tokens. When the adapter's audience configuration option is not set (`clientId` for Google/Apple, `appIds` for Facebook), JWT verification silently skips audience claim validation. This allows an attacker to use a validly signed JWT issued for a different application to authenticate as any user on the target Parse Server. - For Google and Apple, the vulnerability is exploitable when the server does not configure `clientId`. The adapters accepted this as valid and simply skipped audience validation. - For Facebook Limited Login, the vulnerability exists regardless of configuration. The adapter validated `appIds` only for Standard Login (Graph API), but the Limited Login JWT path never passed `appIds` as the audience to JWT verification. #### Patches The fix enforces `clientId` (Google/Apple) and `appIds` (Facebook) as mandatory and passes them to JWT verification for audience validation. While this is technically a breaking change for servers that omit these options, it is not a breaking change as per documentation — all three options are documented as required configuration. #### Workarounds - Google / Apple: Ensure `clientId` is set in the adapter configuration. When set, JWT verification correctly validates the audience claim even on unpatched versions. - Facebook Limited Login: There is no workaround. The unpatched adapter does not pass `appIds` to JWT audience validation, so the only mitigation is to upgrade. #### References - GitHub security advisory: [https://github.com/parse-community/parse-server/security/advisories/GHSA-x6fw-778m-wr9v](https://github.com/parse-community/parse-server/security/advisories/GHSA-x6fw-778m-wr9v) - Fix Parse Server 9: [https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.11](https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.11) - Fix Parse Server 8: [https://github.com/parse-community/parse-server/releases/tag/8.6.10](https://github.com/parse-community/parse-server/releases/tag/8.6.10) ## Affected Packages 2 total 2 fixed Ecosystem Package Vulnerable range Fix 📦npm `parse-server` ≥ 9.0.0-alpha.1&&< 9.5.0-alpha.11 9.5.0-alpha.11`npm install parse-server@9.5.0-alpha.11` 📦npm `parse-server` all versions 8.6.10`npm install parse-server@8.6.10` ## Affected Products 1 product · 12 configurations Application `parse-server`parseplatform ≥ 9.0.0 && < 9.5.0 1 version 9.5.0 ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for parse-server, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update parse-server to 9.5.0-alpha.11 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-30863 is resolved across your whole dependency graph. 3. ### Workarounds Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used. ## Frequently Asked Questions \### Impact The Google, Apple, and Facebook authentication adapters use JWT verification to validate identity tokens. When the adapter's audience configuration option is not set (\`clientId\` for Google/Apple, \`appIds\` for Facebook), JWT verification silently skips audience claim validation. This allows an attacker to use a validly signed JWT issued for a different application to authenticate as any user on the target Parse Server. - For Google and Apple, the vulnerability is exploitable when the server does not configure \`clientId\`. The adapters accepted this as valid and simply skipped audien O3 Security · Impact-Aware SCA ### Is CVE-2026-30863 in your dependencies? Find it across npm, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)